From 0b7c68eb3aa797be17112bea6fb639455a40236b Mon Sep 17 00:00:00 2001 From: dongshengyuan <545258830@qq.com> Date: Tue, 4 Aug 2026 09:58:17 +0800 Subject: [PATCH] userdb: apply UUID filters to group records group_record_match() handled the other filters, but ignored match->uuid, so userdbctl group --uuid=... could still return non-matching groups. Add the same UUID check used by user_record_match(). Reproduced locally: build/userdbctl --uuid=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa \ --output=json group root Before result: The command succeeded and printed the root group record. Follow-up for: 466562c69b75cec197176f556b940a43bb8350f2 --- src/shared/group-record.c | 3 +++ src/shared/userdb.c | 1 + src/shared/varlink-io.systemd.UserDatabase.c | 4 ++++ test/units/TEST-74-AUX-UTILS.userdbctl.sh | 3 +++ 4 files changed, 11 insertions(+) diff --git a/src/shared/group-record.c b/src/shared/group-record.c index 361030f5a2..1c431adf16 100644 --- a/src/shared/group-record.c +++ b/src/shared/group-record.c @@ -372,6 +372,9 @@ bool group_record_match(GroupRecord *h, const UserDBMatch *match) { if (!BIT_SET(match->disposition_mask, group_record_disposition(h))) return false; + if (!sd_id128_is_null(match->uuid) && !sd_id128_equal(match->uuid, h->uuid)) + return false; + if (!strv_isempty(match->fuzzy_names)) { const char* names[] = { h->group_name, diff --git a/src/shared/userdb.c b/src/shared/userdb.c index 7dd9ac7496..e3487fbb62 100644 --- a/src/shared/userdb.c +++ b/src/shared/userdb.c @@ -203,6 +203,7 @@ static int userdb_maybe_restart_query( static const char *const fields[] = { "fuzzyNames", "dispositionMask", + "uuid", "uidMin", "uidMax", "gidMin", diff --git a/src/shared/varlink-io.systemd.UserDatabase.c b/src/shared/varlink-io.systemd.UserDatabase.c index bdcba2be8a..c20d306858 100644 --- a/src/shared/varlink-io.systemd.UserDatabase.c +++ b/src/shared/varlink-io.systemd.UserDatabase.c @@ -18,6 +18,8 @@ static SD_VARLINK_DEFINE_METHOD_FULL( SD_VARLINK_DEFINE_INPUT(uidMin, SD_VARLINK_INT, SD_VARLINK_NULLABLE), SD_VARLINK_FIELD_COMMENT("Maximum UID to restrict search too."), SD_VARLINK_DEFINE_INPUT(uidMax, SD_VARLINK_INT, SD_VARLINK_NULLABLE), + SD_VARLINK_FIELD_COMMENT("The UUID to restrict search to."), + SD_VARLINK_DEFINE_INPUT(uuid, SD_VARLINK_STRING, SD_VARLINK_NULLABLE), SD_VARLINK_FIELD_COMMENT("The userdb provider to search on. Must be set to the name of the userdb entrypoint socket. This is necessary in order to support services that implement multiple userdb services on the same socket."), SD_VARLINK_DEFINE_INPUT(service, SD_VARLINK_STRING, 0), SD_VARLINK_FIELD_COMMENT("The retrieved user record."), @@ -41,6 +43,8 @@ static SD_VARLINK_DEFINE_METHOD_FULL( SD_VARLINK_DEFINE_INPUT(gidMin, SD_VARLINK_INT, SD_VARLINK_NULLABLE), SD_VARLINK_FIELD_COMMENT("Maximum GID to restrict search too."), SD_VARLINK_DEFINE_INPUT(gidMax, SD_VARLINK_INT, SD_VARLINK_NULLABLE), + SD_VARLINK_FIELD_COMMENT("The UUID to restrict search to."), + SD_VARLINK_DEFINE_INPUT(uuid, SD_VARLINK_STRING, SD_VARLINK_NULLABLE), SD_VARLINK_FIELD_COMMENT("The userdb provider to search on. Must be set to the name of the userdb entrypoint socket. This is necessary in order to support services that implement multiple userdb services on the same socket."), SD_VARLINK_DEFINE_INPUT(service, SD_VARLINK_STRING, 0), SD_VARLINK_FIELD_COMMENT("The retrieved group record."), diff --git a/test/units/TEST-74-AUX-UTILS.userdbctl.sh b/test/units/TEST-74-AUX-UTILS.userdbctl.sh index dd57c6fee5..c1746903d0 100755 --- a/test/units/TEST-74-AUX-UTILS.userdbctl.sh +++ b/test/units/TEST-74-AUX-UTILS.userdbctl.sh @@ -55,6 +55,9 @@ assert_eq "$(userdbctl user 2147352576 -j | jq -r .userName)" foreign-0 assert_eq "$(userdbctl user 2147352577 -j | jq -r .userName)" foreign-1 assert_eq "$(userdbctl user 2147418110 -j | jq -r .userName)" foreign-65534 +(! userdbctl --uuid=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa user root) +(! userdbctl --uuid=aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa group root) + # Make sure that -F shows same data as if we'd ask directly userdbctl user root -j | userdbctl -F- user | cmp - <(userdbctl user root) userdbctl user test-74-userdbctl -j | userdbctl -F- user | cmp - <(userdbctl user test-74-userdbctl)